CVE-2026-59133

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName contains "hpccmd.exe" or InitiatingProcessFileName contains "hpccmd.exe" // Beispiel: HPC Pack relevante Prozesse
| where ProcessCommandLine contains "/elevate" or ProcessCommandLine contains "/admin" // Beispiel: Befehlszeilenargumente für Privilegienerhöhung
| where AccountName !contains "NT AUTHORITY\SYSTEM" and AccountName !contains "LOCAL SERVICE" // Filtert bekannte Systemkonten
| where InitiatingProcessParentFileName !in ("explorer.exe", "cmd.exe", "powershell.exe") // Filtert typische Benutzerinteraktionen
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, RemoteIP, RemotePort
| extend ThreatType = "CVE-2026-59133 Potential Privilege Escalation"
| summarize by ThreatType, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, RemoteIP, RemotePort

Splunk SPL

index=windows (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational) 
(Process.process_name="hpccmd.exe" OR ParentProcess.process_name="hpccmd.exe") 
(Process.command_line="* /elevate *" OR Process.command_line="* /admin *") 
NOT (User="NT AUTHORITY\\SYSTEM" OR User="LOCAL SERVICE") 
NOT (ParentProcess.process_name="explorer.exe" OR ParentProcess.process_name="cmd.exe" OR ParentProcess.process_name="powershell.exe") 
| table _time, host, Process.process_name, Process.command_line, ParentProcess.process_name, User, dest_ip, dest_port

Sigma

title: Microsoft HPC Pack Privilege Escalation
id: 00000000-0000-0000-0000-000000000000 # Placeholder, generate a real UUID
status: experimental
description: Detects potential privilege escalation attempts in Microsoft HPC Pack via execution with unnecessary privileges over a network.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-59133
author: SecBoard Operations
date: 2026/08/11
logsource:
    category: process_creation
    product: windows
tags:
    - attack.privilege_escalation
    - cve.2026.59133
detection:
    selection:
        Image|endswith:
            - '\hpccmd.exe'
        CommandLine|contains:
            - '/elevate'
            - '/admin'
    filter_known_accounts:
        User|startswith:
            - 'NT AUTHORITY\\SYSTEM'
            - 'LOCAL SERVICE'
    filter_known_parents:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\cmd.exe'
            - '\powershell.exe'
    condition: selection and not filter_known_accounts and not filter_known_parents
level: high

Elastic ES|QL

from process where 
  (process.executable.name : "hpccmd.exe" or process.parent.executable.name : "hpccmd.exe") and 
  (process.args : "/elevate" or process.args : "/admin") and 
  not (user.name : "NT AUTHORITY\\SYSTEM" or user.name : "LOCAL SERVICE") and 
  not (process.parent.executable.name : "explorer.exe" or process.parent.executable.name : "cmd.exe" or process.parent.executable.name : "powershell.exe")
| select @timestamp, host.name, process.executable.name, process.command_line, process.parent.executable.name, user.name, destination.ip, destination.port